The Office of General 
Counsel 


THIS PRESENTATION 


IS CLASSIFIED 


TOP SECRET//COMINT// 
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General Principles of Law 


a Principle #1: Authority 
(What is the authority to do my job?) 


a Principle #2 Restrictions 
(Is the authority restricted in any way?) 
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Constitution 
Fourth Amendment 


T Protects the right of the people to be 
secure in their persons, houses, 
papers, and effects, against 
unreasonable searches and seizures. 


* Requires probable cause for a search 
warrant. 
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Operation Shamrock: 1945-1975 


im NSA received copies of international telegrams 
to, from, and transiting the U.S. 
Included virtually all international telegrams 
carried by major telecom carriers. 
In later years, 150,000 telegrams per month 
reviewed by NSA analysts 
Probably the largest governmental interception 
program affecting Americans ever undertaken 
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Project Minaret: 1967-1973 
(The Watch List) 


m Names of U.S. persons used 
systematically as basis for selecting 
messages 

m Foreign influence on Domestic Antiwar 
and Civil Rights Activists 
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Narcotics Collection: 1970-1973 


4. Telephone Links between the U.S. and South 
| — America collected 


m Used Names of U.S. persons 


m Obtained Communications that Law 
Enforcement could not acquire under Title III 
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The Problem... 


Congressional Inquiries 
jr Church/Pike Committees 


Information TO, FROM, and ABOUT U.S. 
Citizens was: 


Improperly Collected 


Improperly Retained 
Improperly Disseminated 
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Congressional/Executive 
Response to IC Abuses 


= Federal Law Foreign Intelligence 
Surveillance Act (as amended) 


m Executive Order E.O. 12333 


Intelligence Activities 


 Á > 


m Regulations and 
Procedures DoD 5240.1-R and 


Classified Annex 
USSID SPOO18 (USSID 18) 
Minimization Procedures 
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The Foreign Intelligence 
Surveillance Act (FISA) 


The FISA, was originally passed in 1978. 


Most recently amended in the FISA Amendments Act 
(FAA) of 2008. 


Defines “electronic surveillance” and requires an order 
from the Foreign Intelligence Surveillance Court (FISC) to 
conduct such surveillance. 


As amended, by the FAA, requires that the USG obtain a 
court order to conduct electronic surveillance against US 
persons either in the US or abroad. 
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Definitions 


Electronic 
Surveillance 


U.S. Person 


Foreign Power 


Agent of a Foreign 
Power 


Contents 


w ICIAL vente 
x FISA 
“Electronic Surveillance” 


f(1): acquisition of communications of particular known 
USP inside the US by targeting that person 


f(2): acquisition of wire communication to or from a 
person in the US if acquisition occurs inside the US 


f(3): acquisition of radio communications if all parties to 
the communication are located inside the US 


f(4): monitoring in the US to acquire information other 
than from a radio or wire communication 
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Definitions -- U.S. Persons 


m U.S. Citizen 

— s Permanent Resident Alien 
| (Green Card Holder) 
m Corporations (incorporated in the U.S.) 
m Associations (primary membership 
composed of U.S. persons) 
m U.S. flagged ships/aircraft 


UNCLASSIFIED//FOR OFFICIAL U 


Definitions -- Foreign Power 


= A foreign government or any component 
-— thereof 


m A faction of a foreign nation 


u An entity openly acknowledged to be 
directed or controlled by a foreign 
government(s) 


m a group engaged in international terrorism 
m a foreign based political organization 
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Definitions -- Agent of a foreign power 


— An officer or employee of a foreign 
povver 


u A spy, terrorist, saboteur, 
aider/abettor, or conspirator 
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Definitions 


' Communications 


Any information conc- 
cerning the identity of 
the parties to such 
communications 
OR 


__-UNCLASSIFIED//FOR OFFICIAL USE ONLY 


UNCLASSIFIED//FOR OFFICIA 


-- Contents 


“Substance” 


“Purport” 


“Meaning” 


“Existence” 


FISA Amendments Act of 2008 


a Became law in July 2008 


m Applies to targets overseas 


m Sections /02/703/704/705 


FISA Amendmenis Act of 2008 
Section 702 


m Authorizes the USG to gather foreign intelligence 
by targeting foreign persons reasonably believed to 
be outside the US with authorization jointly 
executed by the AG and DNI. 


m The government must employ targeting procedures 


and minimization procedures which comply with the 
statute and which are reviewed by the FISC. 


m Prohibits “reverse targeting’. 
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FISA Amendments Act of 2008 
Section 703 


— m Authorizes “electronic surveillance" 
against a USP reasonably believed to 
be outside of the US, but -- 


m An order from the FISC is required. 

m Target must be a ‘foreign power”, 
“agent of a foreign power’, or officer or 
employee of a foreign government. 
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FİSA Amendments Act of 2008 
Section 704 


— m Authorizes “other acquisitions" 
targeting US persons overseas — but 


m An order from the FISC is required. 


m [he FISC does not review surveillance 
techniques. 
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FİSA Amendments Act of 2008 
Section 705 


om /05(a) - a judge may simultaneously 
authorize acquisitions conducted both inside 
and outside of the US against a USP 
overseas (703 and 704). 


705(b) - if there is an existing FISA order 
authorizing surveillance of target inside of 
the US, the AG can authorize targeting 
while the USP is reasonably believed to be ` 
outside of the US. 
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777 
United States İntelligence Activities 


Provides goals, directions, and 
responsibilities for the intelligence 
Community 


Defines NSA”s responsibilities (Part 1.12(b) 


Requires each agency to have AG- approved 
procedures, for collection, processing and 
dissemination of U.S. person information 


© UNCLASSIFIED//FOR OFFICIAL USE ONLY 
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E.O. 12333 
United States İntelligence Activities 


== Provides goals, directions, and responsibilities 
for the Intelligence Community 


m Defines NSA”s responsibilities (Part 1.7(c)) 


m Requires each agency to have AG- approved 
procedures, for collection, processing and 
dissemination of U.S. person information 
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E.O. 12333 
United States Intelligence Activities 


m Collection, Processing, and Dissemination of 
Signals Intelligence for National Foreign 
Intelligence Purposes. 


m Collection, Processing, and Dissemination 
for Signals Intelligence for 
Counterintelligence Purposes. 


m SIGINT Support for Military Operations. 
m Information Assurance. 
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REGULATIONS 
E DoD 5240.1-R (1982) 


Procedures Governing the Activities of DoD 
Intelligence Components that Affect 
U.S. Persons 


NSA/CSS Policy 1-23 


Procedures Governing the Activities of NSA/CSS 
that Affect U.S. Persons 


End of Module Tvvo 
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aş 


704, & 705 Mini 
Procedures 


; Anyone targeting US persons 
located outside of the US under FAA is 


required to read and be familiar with the 
minimization procedures 
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(U) © Require nents 
“FAA Sections 703, 704. &705 


(i^ The FAA may authorize collection against: 


v A US person 
v Reasonably believed to be outside of the US 
v To acquire foreign intelligence information 
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Limitations 
NSA Surveillance Under Sections 703, 704, and 705. 


NSA CANNOT use FAA authorities to target: 
e Anything/Anyone in the US 


NSA FAA data CANNOT be: 


~ Accessed without being properly trained on 
NSA s FAA minimization procedures 


~ Processed at locations other than those approved 
by SID 


Targeting-US persons'located outside of the.US 


UNCEASSIFIED//FƏR OFFICIAL USE ONLY ` 
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J FISA Amendments Act of 2008 


. Section 703 


| An order from the FISC to target a US person 
reasonably believed to be outside the US 


!: Authorizes "electronic surveillance" or the 
acquisition of stored electronic communications or 
stored electronic data 


(J) Authorization for up to 90 days — 


ZUNCL ASSIFIED/A FOR Goar enm = ONLY 


; FISA Amendments Act of 20 08 


(1) An order from the FISC to target a US person 
reasonably believed to be outside the US 


(4) Authorizes “other acquisitions" targeting US 
persons overseas (techniques are not described to 
the court) 


FISA Amendments Act of 2008 


Section 705 
Section 705 has two parts, 705(a) and 705(b). 


705(a) authorizes the Government to request, 
and a judge to issue a single order authorizing 703 
and 704 surveillance 


705(b) authorizes the AG to approve 
surveillance of a US person overseas if the FISC 
has already issued an order authorizing electronic 
surveillance or physical search against that US 
person in the US 


Targeting, US persons located outside’of the US 
UNCLASSIFIED 
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NSA Minimization Procedures for Collection Under FAA Sections 
703, 704, & 705 


Minimization Procedures 
need to be Followed Unless... 


To protect US National Security, life or property, or for Law 
enforcement purposes — NSA may deviate from Standard Minimization 
Procedures with AG approval (coordinate in advance with NSA OGC) 


If advance coordination is not feasible and NSA needs to 
act in order to protect against immediate threat to human life — consult 
with NSA OGC who must report any such action within 7 days to DOJ 


if vou believe vou must deviate from the procedures, YOU 
MUST GO TO NSA/OGC FIRST!!!! 


Targeting US persons located outside:of the US 
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NSA Minimization Procedures for Under FAA Sections 703, 704, & 705 


- Collection 


“NSA must terminate collection promptly if NSA learns 
that a targeted US person is located in the US 


“Collection against a US person in the US may only be 
reinstated in accordance with the FISA 


«NSA may resume collection if the target departs the US 
during the life of the order 


. Selectors for 704 and 705 surveillances may be tasked 


rsons located outside of the US 
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NSA Minimization Procedures Under FAA Sections 703, 704, & 705 


Processing 


— -, Searches or reviews of collected 
materials must be designed, to the extent 
operationally possible, to minimize the risk of 
returning data concerning unconsenting US 
person 's who are not the target of authorized 
surveillance 


Targeting US persons located outside of the US 
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NSA Minimization Procedures Under FAA Sections 703, 704, & 705 


Retention 


S//š The following communications shall be 
destroyed upon recognition unless the AG authorizes 
retention: 


Inadvertent collection of communications while the 
target enters the US 

Inadvertent collection of communications in which all 
the communicants are in the US 

Inadvertent collection of communications in which all 
.. the communicants are US a un are not 


AG Destruction VVaiver 


. Inadvertent Collection: Data shall be destroyed unless 
. All communicants the AG determines that the 
inside the US communication contains: 

° Significant foreign 
intelligence 
Evidence of a serious 
crime 


Information related to a 
threat of serious harm to 
life or property 
Technical information 
about a communications 
vulnerability ` 


persons located outside of the US 


ə All communicants 


are US person's 
who are not 
authorized targets 


| + The authorized 
| target is in the US 


: Without AG Destruction Waiver 


Inadvertent Even without a Destruction 
Collection: Waiver, technical data 
- Of US domestic concerning such 
communications communications may be 
retained for collection 


. Against an avoidance purposes 


unauthorized 
target 
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NSA Minimization Procedures Under FAA Sections 703, 704, £ 705 


Retention 


000 NSA may retain FAA data in databases 
for up to 5 years without additional authorization 


e) NSA's SIGINT Director may authorize 
retention for a longer period in response to an 
authorized foreign intelligence or counterintelligence 
requirement 


sting US persons located outside of the US 
İJNCLASSIFIEDUF ER OFFICIAL USE ONLY — 


All incidents should be reported at the time 
of recognition AND again in the IG Quarterly report 


Incidents include: 

Inadvertent and incidental collection 
Unauthorized targets 
Collection continued on targets inside the U S 
Unauthorized access to data: 

= By unauthorized personnel 

= By untrained personnel 

= At non-SID-approved locations 


Inappropriate. storage, labeling, or handling 
Targeting US persons located outside of the US 
UNCLASSIFIED/F CR CFFICIAL USE ONLY 
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7755 > To gain access to data both the. individuali user "and . 
= the location must be certified 
* The user must: 
= Complete this training (renewing it every two years) 
= Maintain current Annual Intelligence Oversight readings 
= Work under DIRNSA’s full operational & technical control 
= Have a mission need 


e The location must: 


= Operate under -. s full operational Es —. 
sulu 


_ Targeting US persons located outside of the US 


FAA Sections 703, 704, & 705 
un Where to go for Help 


OGC: DL GC FISA 
(after hours contact NSOC SOO to get in touch vvith OGC) 
Oversight and Compliance: DL FİSATEAM 


Targeting Mission Management (TMM): DL OPSDICTS 


Documents Available at SV1 Homepage: (‘go SV’) 
= For the Minimization Procedures document 
= Comparison charts of 703/704/705 orders 
" Specific targets authorized under these sections 


Targeting US persóns located outside of the US 
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USSID SP0016 


Legal Compliance and Minimization 
Procedures 


m Main body of SPOO18 Compilation of 
responsibilities from the FISA, E.O. 
12333, and DoD Regulation 5240.1-R as 


they apply to the U.S. SIGINT system 


m covers collection, processing, retention, 
and dissemination 


UVhat is “Collection”? 


-Targeting a SPECIFIC 
COMMUNICANT (e.g. a terrorist, a 
foreign minister, a computer hacker) 


a Collecting based upon SUBJECT 
MATTER (e.g. nuclear proliferation, 
oil sales, economics) 


SECRET/COMINT/20520109 
Targeting Specific Communicants 
SPOO18 Section 4 


The Four Rules 


= No 
without Attorney 
General approval 
m No U.S. Persons in the U.S. without a 
Court Order 
m No U.S. persons outside the U.S. without 
a Court Order 


m Foreign persons outside the U.S. -- fair 


SECRET/COMİNT/20320108 


Targeting by Subject Matter 
USSID SPOO18 Section 5 


Selection terms that: 
° have intercepted or 
* are likely to intercept 
U.S. Person communications 
MUST BE DESIGNED 
* (to the greatest extent practicable under 
the circumstances) 
to DEFEAT communications that 
do not contain foreign intelligence 


8 7570757: 
(If no other information is available) 


min the U.S., then U.S. person 


m Outside the U.S., then foreigner 


GOMINTID n? 


Targeting Definitions 


+ Targeting U.S. Persons 
| = INADVERTENT (Did not know is a U.S. Person) 


= INCIDENTAL (Legitimate foreign target; as a by 
product NSA acquires U.S. Person 
information/communications) 


= REVERSE (Target foreign entity to intentionally 
acquire U.S. Person information/communications) 


SECRET/COMINT//20220“ Ano __ 


USSID SPOO18 
Disseminatıon 


. jm Allow access to non-minimized raw traffic 
=; voice/data database 

m Provide copy of a non-minimized piece of 
raw traffic 

m Disclose (orally or in writing) the contents 
of non-minimized raw traffic 

m Disclose (orally or in writing) the identity 
of a U.S. person contained in an NSA 
product 


|. SECRET/COMINT//20220108 
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USSID SPOO18 ^ "meme 
Dissemination 


== Authorized Recipients of Raw Traffic 


THE SIGINT PRODUCTION CHAIN 
People who Collect Raw Traffic 
People who Process Raw Traffic 
People who Retain Raw Traffic 
People who Manage the SIGINT Process 
People who do Oversight of the SIGINT Process 
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Dissemination 


Examples of Non-SIGINT Production Personnel 


= A Customer in Another Agency (e.g. CIA, 
FBI) 

= Another Agency’s Liaison Representative to 
NSA 

m Non-SIGINT producing NSA Organizations or 
Personnel (e.g Security (Q), Personnel (MD)) 

m NSA Employees Detailed/Assigned to 
Another Agency (e.g. CIA/TMO, IOTC) 

= Any person not necessary to Produce im. 
SIGINT Product 


"SECRETIGOMINT// 20320199 


End of Module Three 


Questions? 
m Who is the target? 


— U.S. Person or Non-U.S. Person 


he Where is the target? 
— Inthe U.S. or Outside the U.S. 
m What kind of communications will be collected? 
— Private (e-mail, wire, cell, encrypted) or Non-Private 
= How will the communications be collected? 


— Passively or Actively 
m Where will the communications be collected? 


— Inthe U.S. or Outside the U.S., or in International 
Waters, or from Outer Space 


Office of General 


Counsel 
(Operations/Intel Law) 


NSOC has an attorney on call 24/7! 


USSID SPOO18 and Rav Traffic 
Databases 
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Years on- ‘fine 


Acc ass EU nd R 


Up to 10 years off-line—request for historical searches 
made to OIPR 


some retention exceptions 
Recognizes intrusiveness of SIGINT 


FISA Data: Depends upon nature of data —check 
USSID SP0018, Annex A, and/or call SV 
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(U//FOUO) Targeting t 
end via dictionaries 
_ With follow-on querie 


Choose qualifiers care 
“AND” and “BUT NOT” 
“OR” will expand your r 


akes place at front 


AND at the keyboard 
AS 


fully 


will reduce your results 


eturns exponentially/” 
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(S/[Sl// ) E-Mail Address Targeting 
Specific e-mail addresses of valid 
foreign intelligence targets outside 

countries may be 
targeted regardless of email 


domain without additional I 
authority. 
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Targeting Deceased U.S. People or 
cpmmunications devices registered to them 
requires: 

a. a VERY strong foreign intelligence 
purpose 


b. mission driver 
c. approval of the NSA OGC 
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